A spam filter can be created that will block all spam; one could simply have the filter block all incoming email. Most users would find such a filter unacceptable, though, so the challenge is to find a balance between blocking email that users don't want to receive, but at the same time allowing through all the email they want to receive. If the filter is very strict, there will likely be false positives and email they would consider legitimate will be blocked. If a relative or friend of the user sends an email that has some characteristics typical of spam messages a strict filter may block it whereas a filter with more loose settings may allow it through.
So should the filter be very strict or less strict? Different users may have different views on the matter. Some may prefer to have less strict settings so that no legitimate email is blocked, but that means more spam gets through. Some may hate spam so much that they are willing to trade off the possibility of legitimate email being blocked in return for getting less spam. A company dealing with a large number of email users may have to pick a moderate level of filtering that applies to all users so that some spam gets through, but, hopefully, resulting in few false positives. But there is always a tradeoff between blocking spam and false positives that block legitimate email.
And as others have mentioned, spam purveyors are constantly trying to outwit anti-spam filters. E.g., one spam detection method is to block email that exactly matches known spam messages. After email service providers started comparing incoming email to known spam and blocking any email messages with content that matched known spam, spam purveyors just started inserting random words in the body of their spam email, often in text invisible to users by having the color of the text match the color of the background for the message, e.g., white text on a white background, so that spam filters could no longer rely on exact matches against known spam messages.
And users should understand that antivirus software won't catch all viruses as soon as they are released by virus developers. Virus developers are also constantly striving to outwit antivirus software. In a December 2013 press release, Kaspersky Lab, an antivirus vendor, reported that Kaspersky Lab is detecting 315,000 new malicious files every day. They reported that the number for the prior year was 200,000. If a user is unlucky enough to be among the first to receive a file containing a newly developed virus, not all antivirus vendors may be aware of that particular virus at the moment he receives it and so may not have a signature for the virus in their software. Suppose two new viruses are released, x and y, antivirus vendor A may be aware of virus x, but not y, whereas antivirus vendor B may be aware of y but not x. If someone is using vendor B's antivirus software, he may be protected from virus y, but x may get through and infect his system, if he is not cautious and opens a file containing it.